US 20060212837 A1 Abstract A method for verifying a digital system design is provided. A first abstraction of a digital system design is performed to obtain an abstract model of the digital system design. One or more first steps of a multiple-step model checking process are performed using the abstract model, the multiple-step model checking process being operable to verify the digital system design. During the multiple-step model checking process, a second abstraction is performed to refine the abstract model. One or more second steps of the multiple-step model checking process are then performed using the refined abstract model.
Claims(8) 1. A method for verifying a digital system design, comprising:
performing a first abstraction of a digital system design to obtain an abstract model of the digital system design; performing one or more first steps of a multiple-step model checking process using the abstract model, the multiple-step model checking process operable to verify the digital system design; during the multiple-step model checking process, performing a second abstraction to refine the abstract model; and performing one or more second steps of the multiple-step model checking process using the refined abstract model. 2. The method of at multiple points during the multiple-step model checking process, performing an additional abstraction to further refine the abstract model; and performing one or more additional steps of the multiple-step model checking process using each of the further refined abstract models. 3. Logic for verifying a digital system design, the logic encoded in one or more media for execution using one or more processors and when executed operable to:
perform a first abstraction of a digital system design to obtain an abstract model of the digital system design; perform one or more first steps of a multiple-step model checking process using the abstract model, the multiple-step model checking process operable to verify the digital system design; during the multiple-step model checking process, perform a second abstraction to refine the abstract model; and performing one or more second steps of the multiple-step model checking process using the refined abstract model. 4. The logic of at multiple points during the multiple-step model checking process, perform an additional abstraction to further refine the abstract model; and perform one or more additional steps of the multiple-step model checking process using each of the further refined abstract models. 5. A system for verifying a digital system design, the system comprising an integrated abstraction and verification module, the integrated abstraction and verification module operable to:
perform a first abstraction of a digital system design to obtain an abstract model of the digital system design; perform one or more first steps of a multiple-step model checking process using the abstract model, the multiple-step model checking process operable to verify the digital system design; during the multiple-step model checking process, perform a second abstraction to refine the abstract model; and performing one or more second steps of the multiple-step model checking process using the refined abstract model. 6. The system of at multiple points during the multiple-step model checking process, perform an additional abstraction to further-refine the abstract model; and perform one or more additional steps of the multiple-step model checking process using each of the further refined abstract models. 7. A system for verifying a digital system design, the system comprising:
means for performing a first abstraction of a digital system design to obtain an abstract model of the digital system design; means for performing one or more first steps of a multiple-step model checking process using the abstract model, the multiple-step model checking process operable to verify the digital system design; means for performing, during the multiple-step model checking process, a second abstraction to refine the abstract model; and means for performing one or more second steps of the multiple-step model checking process using the refined abstract model 8. A method for verifying a digital system design, comprising:
performing a model checking process including a plurality of steps to verify a digital system design, the model checking process using an abstract model of the digital system design including a plurality of logical state elements; after a portion of the plurality of steps, refining the abstract model; and continuing the model checking process using the refined abstract model. Description This invention relates in general to verification of digital designs and, more particularly, to systems and methods for verifying a digital design using dynamic abstraction. The application of formal verification techniques, such as model checking, to real-life industrial designs, has traditionally been hampered by what is commonly known as the state explosion problem. Dramatic increases in the size of digital systems and components and the corresponding exponential increase in the size of their state space have kept industrial-size designs well beyond the capacity of current model checkers. “Abstraction refinement” has recently emerged as a promising technology that has the potential to bridge this verification gap. The basic idea behind abstraction refinement is to attempt to verify the property at hand on a simplified version of the given design. This simplified version, or “abstraction,” is generated by removing elements from the original design that are not relevant to the proof of the given property. If the property passes on the abstract model it is guaranteed to be true on the original design as well. However, if the property fails, counter-examples produced on the abstract model must be validated against the original design. If this is not possible, the process is iterated with another abstract model which approximates the original model more closely. The new abstract model can be obtained by embellishing the current abstraction with more details from the original design or by re-generating a more complete abstract model from the original design. Usually the challenge in abstraction refinement is to construct as small an abstract model as possible, to facilitate the model checking, while retaining sufficient detail in the abstraction to decide the property. Thus, the ideal technique for abstraction refinement is one which achieves a good balance between the size and accuracy of the abstract model. Abstraction refinement methods can be broadly classified into two kinds of methods, namely (1) counter-example driven and (2) counter-example independent. Counter-example driven methods for abstraction refinement typically work by iteratively refining the current abstraction so as to block a particular (false) counter-example encountered in model checking the previous abstract model. The refinement algorithm could use a combination of structural heuristics or fuictional analysis based on SAT or BDDs or some combination of these. Some recent techniques have enlarged the scope of the refinement by using multiple counter-examples from the previous abstract model. The basic idea of counter-example independent abstraction refinement is to perform a SAT-based bounded model check (BMC) of the property up to some depth, k, on the original design and generate the abstract model through an analysis of the proof of unsatisfiability of the BMC problem. Essentially, the abstraction excludes latches and/or gates that are not included in the proof of unsatisfiability of the BMC problem and thereby guarantees that the abstract model also does not have any counter-examples up to depth k. Successive abstract models are similarly generated by solving BMC problems of increasing depth. In accordance with the present invention, system and methods are provided for verifying a digital design using dynamic abstraction. According to one embodiment, a method for verifying a digital system design is provided. A first abstraction of a digital system design is performed to obtain an abstract model of the digital system design. One or more first steps of a multiple-step model checking process are performed using the abstract model, the multiple-step model checking process being operable to verify the digital system design. During the multiple-step model checking process, a second abstraction is performed to refine the abstract model. One or more second steps of the multiple-step model checking process are then performed using the refined abstract model. According to another embodiment, logic for verifying a digital system design is provided. The logic is encoded in one or more media for execution using one or more processors and, when executed, is operable to perform a first abstraction to obtain an abstract model of a digital system design. The logic is further operable to perform one or more first steps of a multiple-step model checking process using the abstract model, the multiple-step model checking process operable to verify the digital system design. The logic is further operable to perform, during the multiple-step model checking process, a second abstraction to refine the abstract model, and to perform one or more second steps of the multiple-step model checking process using the refined abstract model. According to yet another embodiment, a system for verifying a digital system design is provided. The system includes an integrated abstraction and verification module. The integrated abstraction and verification module is operable to perform a first abstraction to obtain an abstract model of a digital system design, and to perform one or more first steps of a multiple-step model checking process using the abstract model, the multiple-step model checking process being operable to verify the digital system design. The integrated abstraction and verification module is operable to perform, during the multiple-step model checking process, a second abstraction to refine the abstract model, and to perform one or more second steps of the multiple-step model checking process using the refined abstract model. According to still another embodiment, another method for verifying a digital system design is provided. A model checking process including a plurality of steps is performed to verify a digital system design. The model checking process uses an abstract model of the digital system design that includes a plurality of logical state elements. After a portion of the plurality of steps, the abstract model is refined, and the model checking process is continued using the refined abstract model. According to still another embodiment, another system for verifying a digital system design is provided. The system includes means for performing a first abstraction to obtain an abstract model of a digital system design, and means for performing one or more first steps of a multiple-step model checking process using the abstract model, the multiple-step model checking process being operable to verify the digital system design. The system also includes means for performing, during the multiple-step model checking process, a second abstraction to refine the abstract model, and means for performing one or more second steps of the multiple-step model checking process using the refined abstract model. Various embodiments of the present invention may benefit from numerous advantages. It should be noted that one or more embodiments may benefit from some, none, or all of the advantages discussed below. Previous techniques for abstraction refinement work on static abstractions, in that the abstract model produced by the abstraction algorithm is not modified by the downstream model checking. In general, the present invention includes dynamic methods of abstraction, which can be applied during successive steps of the model checking algorithm to further abstract the model produced by traditional static abstraction methods. This is facilitated by information gathered from an analysis of the proof of unsatisfiability of SAT-based bounded model checking problems, solved on the concrete model, and passed to the model checker. It effectively allows the model checker to work with smaller abstract models. Such dynamic abstraction significantly improves the performance of the abstraction refinement flow and also enables the successful application of abstraction refinement-based model checking to larger designs. More particularly, when a property is checked on a circuit model using, for instance, a typical BDD-based symbolic model checker, there may be state elements that are “partially abstractable,” i.e., while the state element is necessary in the proof of the property, it may actually be required only in certain image computation steps. For example, there may be latches in a circuit design that are solely present for initialization purposes, i.e., for the purpose of proving the given property they effectively become redundant after a few steps of image computation. The present invention includes systems and methods of dynamic abstraction whereby the design under verification is abstracted during successive image computation steps of the model checking phase. This abstraction can be performed in addition to and after the abstraction through a traditional static abstraction algorithm. This provides for a more aggressive yet accurate abstraction methodology, effectively allowing the core model checking algorithm to work on smaller abstract models. In some embodiments, information regarding the dynamic abstractability of different latches is deduced from an analysis of the unsatisfiable core of SAT-based bounded model checking problems, solved on the concrete model, and passed to the model checker. An important benefit of such dynamic abstraction is that because it is tightly coupled to the model checker, feedback from the model checking process can be effectively used to guide the model checking process. As discussed above, traditional abstraction refinement techniques share two common features, namely (1) the abstraction step is algorithmically distinct from the model checking, i.e., the abstraction is performed outside the model checker, and (2) the abstraction is purely structural in nature and has no temporal component, i.e., the same structural abstraction is used for each image computation step in BDD-based model checking (or each unrolled time-frame in SAT-based BMC). The abstraction refinement techniques of the present invention can be distinguished from such traditional abstraction refinement techniques based on these two aspects. The abstraction refinement techniques of the present invention analyze the temporal behavior of various state elements (e.g. latches) and based on this analysis, dynamically abstracts sets of state elements (e.g. latches) during the course of the model checking. Thus, the abstraction and the model checking verification finctions are integrated. For example, in the case of a BDD-based model checker, successively more abstracted versions of the transition relation are used for successive image computation steps. The dynamic abstraction techniques of the present invention can be applied in addition to any abstraction performed by any traditional static abstraction methods. For example, the dynamic abstraction techniques of the present invention may be applied to both counter-example dependant and counter-example independent abstraction refinement frameworks. Other advantages will be readily apparent to one having ordinary skill in the art from the following figures, descriptions, and claims. For a more complete understanding of the present invention and for further features and advantages, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which: Example embodiments of the present invention and their advantages are best understood by referring now to In general, systems and methods for verifying a digital design using dynamic abstraction in model checking processes are provided. Unlike traditional abstraction refinement techniques, which consist of static abstractions, the systems and methods provided herein include dynamic abstraction techniques, which can be applied during successive steps of a model checking algorithm to further abstract the model produced by traditional static abstraction techniques. In some embodiments, this dynamic abstraction is facilitated by information gathered from an analysis of the proof of unsatisfiability of SAT-based bounded model checking problems, solved on the concrete model, and passed to the model checker. The dynamic abstraction effectively allows the model checker to work with smaller abstract models, and significantly improves the performance of the abstraction refinement flow, and also enables the successful application of abstraction refinement-based model checking to larger designs. Integrated abstraction and verification tool Integrated abstraction and verification tool Particular embodiments of the functionality performed by integrated abstraction and verification tool Abstraction Introduction The following discussion focuses on model checking of invariants, i.e., CTL properties of the form AGp where p is a Boolean expression on the variables of the given circuit model. The circuit under verification can be modeled as a sequential circuit M with primary inputs W={w Given a subset of latches L where Ŵ=W ∪ X A concept that will be frequently used in the following treatment is that of the proof of unsatisfiability (POU) of a CNF SAT formula. As known in the art, certain modem SAT solvers can be modified to produce a proof of unsatisfiability when the CNF formula being solved is found to be unsatisfiable. The proof of unsatisfiability (denoted by P in the sequel) of a SAT CNF formula can be represented as a directed acyclic graph, the nodes of which are clauses and each node (other than the leaves) has precisely two children. The root of this graph is the empty clause and the leaves are clauses from the original CNF. All other nodes (including the root) such that they can be derived through a resolution operation on their two children clauses. A simplified version of the algorithm for abstraction refinement in some embodiments is shown as Algorithm 1.
The abstraction is based on the use of SAT-based bounded model checking (BMC). Let ν be a variable in the representation of the transition relation T. A k-step BMC problem is generated by unrolling and replicating T, k times. Let ν The model checking algorithm employed in Algorithm 1 (Step 8) may use a variety of methods. For simplicity of exposition we will assume a symbolic model checker using BDDs. However, our ideas can be applied to other methods, such as SAT-based induction or BMC, for example, in a fairly straightforward manner. Algorithm 2 shows the pseudo-code for a symbolic invariant checking algorithm that could use BDDs. Here, B denotes the “bad states,” i.e., states that violate p, and S
Dynamic Abstraction The dynamic abstraction technique of particular embodiment of the present invention is based on an analysis of the proof of unsatisfiability of a SAT-BMC problem solved on the concrete design. Given the original circuit M and the property P=AGp, suppose that a SAT-BMC problem of depth k has been solved on M and found no counter-example. Further, suppose that the SAT solver generates a proof of unsatisfiability P for this problem. D For example, in In the following discussion, a result is developed which shows that latch l can be dynamically abstracted from the transition relation anytime after p(l) image computation steps in the invariant checking algorithm of Algorithm 2, and still have the model checking result match that of the BMC up to the first k steps. At each step of image computation a “candidate set” of latches can be defined, which is essentially the set of latches whose redundancy index is less than or equal to the index of the current image computation step. D For example, in
In Algorithm 3, X Because the dynamic abstraction is developed from an analysis of the POU of a k-step SAT-BMC problem, the following result can be stated about the correctness of Algorithm 1: T The proof of this result is based on the observation that the above dynamic abstraction implementation is equivalently implemented as SAT-BMC by unrolling T for k time-frames and cutting open the unrolled latches in the requisite time-frames that were abstracted by the dynamic abstraction algorithm during the image computation. The original POU P still applies to this abstracted BMC problem since the abstracted variables did not appear in it to begin with. Latch Selection Heuristic A key component of Algorithm 1 is the latch selection heuristic C The most aggressive approach would be to perform dynamic abstraction for all latches in the current candidate set and at the earliest possible time as indicated by the redundancy index (RI) of each latch. However, this approach may have several drawbacks. The following issues drive the choice of this heuristic Issue (1): How often to abstract latches: In the aggressive version of the heuristic described above, abstraction may need to be performed very frequently, in the most extreme case at every image computation step. Since the dynamic abstraction is implemented via quantification of next-state variables, from the transition relation (TR), the overhead can be significant. Thus, in embodiments in which the reduction of overhead (e.g. computational resources) is desired, a heuristic that limits the abstraction to a few image computation steps may be used. Issue (2): Extrapolating unbounded behavior from p(l): In abstraction based on POU of a k-step SAT-BMC we are trying to extrapolate unbounded behavior of a latch, with respect to the given property, based on its bounded behavior. Intuitively, a latch that was active only in the first few steps of the BMC (i.e. one that has a small RI), such as latch l Issue (3): Size and depth of the reachable state space: Abstraction of latches comes at the cost of enlarging the set of permissible behaviors of the circuit. This can potentially enlarge the reachable state space, result in larger BDDs for the reached state representation, and/or increase the depth of the reachability computation. This factor should be considered by the latch selection heuristic if possible. With the above criteria in mind, several heuristics have developed and tested for C Heuristic 1: Dynamically abstract just once at [δ·k] time-steps, (where 0<δ<1), and abstract all latches in the candidate set at this point. The philosophy behind this heuristic is to minimize the overheads of abstraction by doing it only once (Issue (1) above) and being aggressive by choosing all candidates for abstraction. δ is kept fairly low to increase the likelihood of the latches being redundant for future image computations (in agreement with Issue (2) above). δ=0.2 was used in particular experiments but other small values are equally or similarly effective. Heuristic 2: Before the start of model checking analyze the proof P and gather a set of latches S={l:l εL, p(l)≦δ·k}. Every r steps of image computation, compute the set of latches N not in the support set of current reached state set BDD. If |S∩N|≧r abstract all latches in the set S∩N. Repeat every r image computation steps. The intuition behind using the set N is that the removal of such latches is less likely to cause a blow-up in the current step of image computation. This relates to Issue 3 discussed above. Parameter settings of δ=0.2, r=2, r=10 were used in particular experiments, but the heuristic is not sensitive to these particular settings. Qualitatively, Heuristic 1 is based on an aggressive one time application of dynamic abstraction whereas Heuristic 2 is a more conservative, and controlled application of dynamic abstraction. This distinction is illustrated by the example experiments discussed below in the “Experimental Results” section. Optimizations Discussed below are some inexpensive optimizations that can be used to further improve the performance of a model checking algorithm that performs dynamic abstraction as described above. (1) Bypassing the Error-State Check: A simple corollary of Theorem 1 is the following: C This simple result obviates the need to perform the error state intersection check (line (2) Cone of Influence Reduction: An abstraction of some latches can create opportunities for further abstraction by applying a standard cone of influence (COI) reduction on the abstracted model. Optimization may be performed after each abstraction step in the dynamic abstraction algorithms of the present invention. The key point is that any subsequent abstraction due to the COI reduction does not increase the space of allowable behaviors of the design. Thus, the quality of the abstraction is not diminished in any way but the design becomes smaller and more tractable for the model checking. Experimental Results The dynamic abstraction algorithm described above, as well as a static abstraction algorithm, was implemented in C++ within a suitable VIS framework. POU extraction was extended to report the redundancy index (RI) for each latch. The downstream model checker was modified to take RIs of latches as inputs and can further abstract the statically abstracted model on the fly using particular latch selection heuristics. CUDD was used for the BDD-based computation, and Z Integrated abstraction and verification tool Columns As shown in Table 1, dynamic heuristic 1 is extremely powerful in reducing the overall runtime, even though the number of additional abstracted latches is not very significant in some cases. For example, with only 10 additional latches abstracted away for P Table 2 of Conclusion Integrated abstraction and verification tool Although the presented framework is a complete method for abstraction refinement based model checking, the concept of dynamic abstraction of the present invention extends beyond the specific implementation presented herein and may be applied in any other suitable framework. For example, the notion of dynamic abstraction may be applied to other abstraction refinement frameworks incorporating a variety of model checking techniques and other heuristics for static abstraction. Although an embodiment of the invention and its advantages are described in detail, a person skilled in the art could make various alterations, additions, and omissions without departing from the spirit and scope of the present invention as defined by the appended claims. Referenced by
Classifications
Legal Events
Rotate |